2 files changed, 10 insertions, 2 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 90f597b..f43eb82 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -86,6 +86,10 @@ local cookie_path = "/"
 -- Set this true only if cgit is served over plain HTTP with no TLS anywhere.
 local cookie_insecure = false
 
+-- crypt feeds the password into most of its rounds, so its work grows with
+-- the password's length, and one longer than this is turned down unchecked.
+local max_password_bytes = 256
+
 -- A throwaway hash of the documented shape, used only to spend the same work
 -- on a missing account as on a present one, so a failed login does not reveal
 -- by timing whether the user name exists.
@@ -449,7 +453,7 @@ function authenticate_post()
 	local username = post["username"]
 	local password = post["password"]
 	local ok = false
-	if username ~= nil and password ~= nil then
+	if username ~= nil and password ~= nil and #password <= max_password_bytes then
 		local hash = account_hash(username)
 		if hash == nil then
 			-- Spend the work anyway, see dummy_hash.
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index de91f88..53b1efc 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -86,6 +86,10 @@ local cookie_path = "/"
 -- Set this true only if cgit is served over plain HTTP with no TLS anywhere.
 local cookie_insecure = false
 
+-- crypt feeds the password into most of its rounds, so its work grows with
+-- the password's length, and one longer than this is turned down unchecked.
+local max_password_bytes = 256
+
 -- A throwaway hash of the documented shape, used only to spend the same work
 -- on a missing account as on a present one, so a failed login does not reveal
 -- by timing whether the user name exists.
@@ -411,7 +415,7 @@ function authenticate_post()
 	local username = post["username"]
 	local password = post["password"]
 	local ok = false
-	if username ~= nil and password ~= nil then
+	if username ~= nil and password ~= nil and #password <= max_password_bytes then
 		local hash = account_hash(username)
 		if hash == nil then
 			-- Spend the work anyway, see dummy_hash.